Does ISO 31000 prescribe a 5 by 5 risk matrix?

No specific 5 by 5 matrix, 1–25 score bands, colour scheme, consequence values or treatment actions are implemented here. Use the risk criteria and assessment technique approved for the organization and context.

Is consequence rating multiplied by likelihood rating always a valid risk score?

No. Ordinal labels do not automatically form ratio scales, and equal products can hide different consequence-likelihood coordinates. The product is shown only when the controlled method explicitly defines it and remains unclassified.

Can this worksheet decide whether work should stop?

No. It records a controlled criterion lookup supplied by the assessor. Legal duties, immediate danger, mandatory controls, competence, escalation and stop-work authority are governed by applicable law and organizational procedures.

What is the difference between inherent and residual risk?

The terms and treatment of controls vary by method. The assessor must select the basis defined by the approved procedure and record the actual existing or assumed controls; this worksheet does not silently compare unlike bases.

Approved-method lookup record

Controlled Risk-Criteria Record Worksheet

Record consequence and likelihood coordinates from an approved organizational method. This worksheet does not invent an “ISO matrix,” colour band, acceptability verdict, stop-work rule, financial range or review deadline.

No universal 5×5 matrixNo automatic tolerability decisionTraceable criteria required

Assessment basis

Arithmetic index policy

Controlled consequence rating C (positive integer 1–99)

Controlled likelihood rating L (positive integer 1–99)

Exact consequence-band definition

Exact likelihood/frequency-band definition

Hazard/event, consequence scenario and exposed objective

Existing/assumed controls and evidence for this basis

Approved method/matrix source, owner, version and effective date

Controlled matrix cell/outcome and required treatment or escalation

Assessor, competent reviewer/risk owner and review date

I confirm that C and L are identifiers from the same approved scale and assessment basis; likelihood refers to the stated consequence, not merely the initiating event; credited controls and uncertainty are recorded; and the controlled matrix cell/outcome was looked up in the cited method. I understand that an ordinal product does not itself establish risk magnitude, acceptability, legal compliance, treatment priority, permission to continue or a stop-work decision.

Risk-criteria lookup record

—

Consequence × likelihood coordinate

—

Unclassified arithmetic index

—

Assessment basis

—

Approved controlled outcome

—

Consequence definition

—

Likelihood definition

—

No automatic authorization: urgent hazards and legal duties must be handled under applicable law, emergency/stop-work rules and competent organizational procedures. This record cannot make work safe or authorize continuation.

Coordinate-preserving record

coordinate = (C, L)
optional index = C × L, only when the cited method explicitly defines it

C and L are controlled identifiers, not automatically physical ratio-scale quantities. The ordered pair is always retained because different coordinates can have the same product: (1,4), (2,2) and (4,1) all give 4 but describe different consequence-likelihood combinations.

The worksheet never maps the coordinate or product to “Low,” “Medium,” “High,” “Critical,” “acceptable,” “tolerable,” “intolerable” or an action. The assessor supplies the approved cell/outcome verbatim from the controlled method, including its basis, scope and authority.

Minimum context

A usable assessment states the objective and scenario, the consequence being rated, the likelihood of that consequence, exposure period, people/assets/environment affected, controls credited, uncertainty, assessment basis, competence, risk owner and review trigger. A coloured number without that record is not a defensible engineering or OH&S decision.

ISO 31000

ISO 31000:2018, Edition 2, Risk management—Guidelines, remains Published but is at stage 90.92 “to be revised.” ISO/CD 31000, Edition 3 is under development at committee stage. ISO’s public description presents a general approach that organizations customize to their context; it does not make this page’s former 5×5 bands an ISO matrix.

ISO 45001

ISO 45001:2018, Edition 1, Occupational health and safety management systems—Requirements with guidance for use, remains Published, has Amendment 1:2024, is at stage 90.92 “to be revised,” and has a next version under development. Its public overview includes leadership, worker participation, hazard identification, risk assessment, legal compliance and continual improvement. That scope does not validate the former universal euro-loss bands or automatic stop/approval rules.

IEC 31010

IEC 31010:2019, Edition 2, Risk management—Risk assessment techniques, is Published at close-of-review stage 90.60 and supersedes IEC 31010:2009. The official description emphasizes selecting, applying, verifying and validating techniques for the situation. Detailed technique content is licensed: NEEDS_LICENSED_SOURCE before claiming clause-level conformance.

The UK Health and Safety Executive’s official COMAH surface-engineering guidance says the likelihood of the particular severity outcome should be used and that any matrix should be reviewed for suitability to the assessment. Its displayed bands are explicitly an example for that context—not universal values for this website.

HSE’s offshore risk-assessment information sheet describes matrices as a convenient ranking/presentation method for qualitative or semi-quantitative approaches and stresses discrimination between the installation’s hazardous events. It does not establish this page’s former 1–25 bands.

Cox, What’s Wrong with Risk Matrices?, Risk Analysis 28(2), 2008, documents mathematical limitations including poor resolution and potentially misleading rankings. This supports preserving the coordinate, source and uncertainty rather than treating an ordinal product as universal risk magnitude.

Former output/claim	Confirmed problem and correction
“ISO 45001 / ISO 31000 aligned” 5×5 matrix	A disclaimer admitted the standards prescribe no such matrix, yet the runtime and copy still branded its invented bands as aligned. The replacement cites actual lifecycle/scope and implements no ISO matrix.
Universal euro-loss, injury and frequency bands	The bands mixed OH&S and finance, ignored exposure and context, and had no controlled source. They were removed; exact approved definitions must be entered.
C×L automatically mapped to Low/Medium/High/Critical	Ordinal multiplication and product collisions do not create a universal risk magnitude. The coordinate is retained; a product appears only when the approved method explicitly defines it and remains unclassified.
Acceptable/tolerable/intolerable and stop/approval/reassess-within-24-hours actions	These were unauthorised safety and management decisions. All automatic verdicts/actions/colours were removed; the approved outcome is copied from the cited procedure.
Defaults, presets, interactive coloured matrix and dynamic HTML/SVG	Example/stale selections immediately issued authoritative decisions. The replacement starts blank, requires provenance/context/controls/owner and confirmation, validates strict integers and uses textContent.

No. It records coordinates and a controlled lookup from the organization’s cited method. No ISO-branded matrix, band or action is generated.

Because ordered ratings may be ordinal and different coordinates share the same product. Select product only if the approved method explicitly defines that arithmetic.

No. It requires the assessor/reviewer/risk owner and source precisely because competence, authority, legal duties and uncertainty are external to arithmetic.